18 Installing and Configuring Oracle Entitlements Server

18.2.2.1 Oracle Fusion Middleware Certification

It is recommended that you read the Oracle Fusion Middleware Supported System Configurations document. This document provides certification information for Oracle Fusion Middleware, including supported installation types, platforms, operating systems, databases, JDKs, and third-party products related to Oracle Identity and Access Management 11g Release 1 (11.1.1).

You can access the Oracle Fusion Middleware Supported System Configurations document by searching the Oracle Technology Network (OTN) web site:

http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html

18.2.2.2 System Requirements

For more information, see System Requirements.

18.2.2.3 Obtaining the Oracle Fusion Middleware Software

For installing Oracle Entitlements Server Administration Server, you must obtain the following software:

• Oracle WebLogic Server

• Oracle Database (Recommended)

• Oracle Repository Creation Utility

• Oracle Identity and Access Management Suite

For more information on obtaining Oracle Fusion Middleware 11g software, see Oracle Fusion Middleware Download, Installation, and Configuration ReadMe.

18.2.2.4 Installing Oracle WebLogic Server and Creating the Oracle Middleware Home

Before you can install Oracle Identity and Access Management 11g Release 1 (11.1.1) components, you must install Oracle WebLogic Server and create the Oracle Middleware Home directory.

For more information, see "Install Oracle WebLogic Server" in Oracle Fusion Middleware Installation Planning Guide.

In addition, see Oracle Fusion Middleware Installation Guide for Oracle WebLogic Server for complete information about installing Oracle WebLogic Server.

18.2.2.5 Installing Oracle Database (Recommended)

For more information, see Installing Oracle Database.

18.2.2.6 Creating a Schema for Oracle Entitlement Server

Depending on the policy store you choose for Oracle Entitlements Server, complete one of the following:

• Using Oracle Database for Oracle Entitlement Server Policy Store

• Using Apache Derby for Oracle Entitlement Server Policy Store

Using Oracle Database for Oracle Entitlement Server Policy Store

If you are using Oracle Database for Oracle Entitlements Server policy store, then create an OES schema and an MDS schema by using the Oracle Fusion Middleware Repository Creation Utility (RCU). Refer to Creating Database Schema Using the Oracle Fusion Middleware Repository Creation Utility (RCU) for more information about creating schemas.

Using Apache Derby for Oracle Entitlement Server Policy Store

If you are using Apache Derby for Oracle Entitlements Server policy store, then you must complete the following:

1. Open setNetworkServerCP (Located at wlserver_10.3/common/derby/bin on UNIX) or setNetworkServerCP.bat (Located at wlserver_10.3\common\derby\bin on Windows) in a text editor and specify the DERBY_HOME as shown in the following example:

   DERBY_HOME="Oracle/Middleware/wlserver_10.3/common/derby"
   

2. Start the Apache Derby database by running the following commands:

   • setNetworkServerCP (UNIX) or setNetworkServerCP.bat (Windows).

   • startNetworkServer (Located at wlserver_10.3/common/derby/bin on UNIX) or startNetworkServer.bat (Located at wlserver_10.3\common\derby\bin on Windows).

   You can also run startDerby.sh (Located at wlserver_10.3/common/bin) or startDerby.cmd (Located at wlserver_10.3\common\bin) to start the Apache Derby database. The Apache Derby database also starts automatically when you start Oracle WebLogic Server.

3. Test the network server connection, by running ij(Located at wlserver_10.3/common/derby/bin on UNIX) or ij.bat (Located at wlserver_10.3\common\derby\bin on Windows) as follows:

   bin/ij
   

4. Connect to the Apache Derby Server, as shown in the following example:

   ij> connect 'jdbc:derby://127.0.0.1:1527/data/oesdb;create=true';
   

   oesdb is the name of database and data is the relative path (based on the directory where you start the server. In this example, it is Oracle/Middleware/wlserver_10.3/common/derby/bin where the database files will be saved.

5. Open opss_user.sql (Located at RCU_HOME/rcu/integration/apm/sql/derby) in a text editor and replace &&1 with the schema user name.

   Repeat the above steps for the following SQL files (Located at RCU_HOME/rcu/integration/apm/sql/derby):

   • opss_tables.sql

   • opss_version.sql

   • opss_gencatalog.sql

   Note:

   This is the schema name you will specify when you configure the Oracle Entitlements Server described in Configuring Oracle Entitlements Server Administration Server.

6. Run the following SQL files (Located at RCU_HOME/rcu/integration/apm/sql/derby) in the ij console:

   • run'opss_user.sql';

   • run'opss_tables.sql';

   • run'opss_version.sql';

   • run'opss_gencatalog.sql';

   Note:

   Ensure that you run the SQL files in the same order listed above and make a note of the schema owner and password that you have created.

18.2.2.7 Starting the Installer

This topic explains the steps that are common to starting most Oracle Identity and Access Management installations and configurations. It begins with starting the Installer and ends after you complete the steps on the Prerequisites Check screen.

Perform the following steps to start an Oracle Identity and Access Management installation:

1. Download the contents of the ofm_iam_generic_11.1.1.5.0_disk1_1of1.zip file to a directory. By default, this directory is named ofm_iam_generic_11.1.1.5.0_disk1_1of1.

2. Change your present working directory to ofm_iam_generic_11.1.1.5.0_disk1_1of1/Disk1 directory under the ofm_iam_generic_11.1.1.5.0_disk1_1of1 folder.

3. Start the Installer by executing one of the following commands:

   UNIX: <full path to the runInstaller directory>/runInstaller -jreLoc <Middleware Home>/jdk160_24/jre

   Windows: <full path to the setup.exe directory>\ setup.exe -jreLoc <Middleware Home>\jdk160_24\jre

   Note:

   The installer prompts you to enter the absolute path of the JDK that is installed on your system. When you install Oracle WebLogic Server, the jdk160_24 directory is created under your Middleware Home. You must enter the absolute path of the JRE folder located in this JDK when launching the installer. For example, on Windows, if the JRE is located in C:\oracle\Middleware\jdk160_24, then launch the installer from the command prompt as follows:

   C:\setup.exe -jreLoc C:\oracle\Middleware\jdk160_24\jre

   You must specify the -jreLoc option on the command line when using the JDK to avoid installation issues. If this option is not specified on the command line, then you might get the following error:

   InvocationTargetException
   

18.2.2.8 Installation Screens and Instructions

Follow the instructions in Table 18-1 to install Oracle Entitlements Server.

If you need additional help with any of the installation screens, click Help to access the online help.

18.2.2.9 Verifying Oracle Entitlements Server Installation

To verify that your Oracle Entitlements Server Administration Server install was successful, go to your Oracle Middleware Home directory associated with the Oracle Identity and Access Management 11g Release 1 (11.1.1.5.0) installation and verify that the OES folder is created under IDM_HOME.

18.3.2.1 Installing Oracle Entitlements Server

You must install Oracle Entitlements Server Administration Server as described in Installing Oracle Entitlements Server Administration Server.

18.3.2.2 Editing the weblogic.policy file

To edit the weblogic.policy file, run the following command:

IDM_HOME/common/bin/wlst.sh IDM_HOME/oes/modifygrants.py

grant codeBase "file:${idm.opss.oracle.home}/modules/oracle.jps_${jrf.version}/*" {
    permission java.security.AllPermission;
};
 
grant codeBase "file:${idm.opss.oracle.home}/oes/*" {
    permission java.security.AllPermission;
};
 
grant codeBase "file:${oes.client.home}/-" {
    permission java.security.AllPermission;
};

18.3.2.3 Extracting Apache Derby Template (Optional)

If you are using Apache Derby, then you must extract the oracle.apm_11.1.1.3.0_template_derby.zip file (Located at IDM_HOME/common/templates/applications) and save oracle.apm_11.1.1.3.0_template_derby.jar file to the following location:

IDM_HOME\common\templates\applications

18.5.1.1 Configuring Java Security Module in a Controlled Mode

To configure Java Security Module instance in a controlled distribution mode, do the following:

1. Open smconfig.java.controlled.prp file (Located at, OES_CLIENT_HOME/oessm/SMConfigTool) in a text editor, and then specify the parameters described in Table 18-5.

2. Run the config.sh (Located at OES_CLIENT_HOME/oessm/bin on UNIX) or config.cmd (Located at OES_CLIENT_HOME\oessm\bin on Windows) as follows:

   config.sh –smConfigId <SM_NAME> -prpFileName OES_CLIENT_HOME/oessm/SMConfigTool/smconfig.java.controlled.prp
   

3. When prompted, specify the following:

   • Oracle Entitlements Server user name (This is the Administration Server's user name).

   • Oracle Entitlements Server password (This is the Administration Server's password)

   • New key store password for enrollment

18.5.1.2 Configuring RMI Security Module in a Controlled Mode

To configure RMI Security Module instance in a controlled distribution mode, then do the following:

1. Open smconfig.rmi.controlled.prp file (Located at OES_CLIENT_HOME/oessm/SMConfigTool) in a text editor, and then specify the parameters described in Table 18-5.

2. Run the config.sh (Located at OES_CLIENT_HOME/oessm/bin on UNIX) or config.cmd (Located at OES_CLIENT_HOME\oessm\bin on Windows) as follows:

   config.sh –smConfigId <SM_NAME> -RMIListeningPort <RMISM_PORT> -prpFileName OES_CLIENT_HOME/oessm/SMConfigTool/smconfig.rmi.controlled.prp
   

3. When prompted, specify the following:

   • Oracle Entitlements Server user name (This is the Administration Server's user name)

   • Oracle Entitlements Server Password (This is the Administration Server's password)

   • New key store password for enrollment

18.5.1.3 Configuring Web Service Security Module in a Controlled Mode

To configure Webservice Security Module instance in a controlled distribution mode, do the following:

1. Open smconfig.ws.controlled.prp file (Located at OES_CLIENT_HOME/oessm/SMConfigTool) in a text editor, and then specify the parameters described in Table 18-5.

2. Run the config.sh (Located at OES_CLIENT_HOME/oessm/bin on UNIX) or config.cmd (Located at OES_CLIENT_HOME\oessm\bin on Windows) as follows:

   config.sh –smConfigId <SM_NAME> -WSListeningPort <WSSM_PORT> -prpFileName OES_CLIENT_HOME/oessm/SMConfigTool/smconfig.ws.controlled.prp
   

3. When prompted, specify the following:

   • Oracle Entitlements Server user name (This is the Administration Server's user name)

   • Oracle Entitlements Server password (This is the Administration Server's password)

   • Key store password for enrollment

18.5.1.4 Configuring Oracle WebLogic Server Security Module in a Controlled Mode

To configure Oracle WebLogic Server Security Module instance in a controlled distribution mode, do the following:

1. Open smconfig.wls.controlled.prp file (Located at OES_CLIENT_HOME/oessm/SMConfigTool) in a text editor, and then specify the parameters described in Table 18-5.

2. Run the config.sh (Located at OES_CLIENT_HOME/oessm/bin on UNIX) or config.cmd (Located at OES_CLIENT_HOME\oessm\bin for Windows) as follows:

   config.sh –smConfigId <SM_NAME> -prpFileName $OES_CLIENT_HOME/oessm/SMConfigTool/smconfig.wls.controlled.prp –serverLocation <Location of Web Logic Server Home 
   

3. Create a OES Client, as described in Section 18.5.4, "Creating the OES Client Domain".

18.5.2.1 Configuring Controlled Distribution

To configure a controlled Distribution mode, open the smconfig.prp file (Located at OES_CLIENT_HOME/oessm/bin/SMConfigTool) in a text editor, and edit the following parameters described in Table 18-5.

18.5.2.2 Configuring Non-Controlled and Controlled Pull Distribution Mode

Open the smconfig.prp file (Located at OES_CLIENT_HOME/oessm/bin/SMConfigTool) in a text editor and edit the following parameters described in Table 18-6.

When prompted, specify the following:

• Oracle Entitlements Server user name (This is the Administration Server's user name).

• Oracle Entitlements Server password (This is the Administration Server's password)

• New key store password for enrollment

18.5.3.1 Creating Java Security Module

The Java Security Module is a generic Policy Decision Point that provides authorization decisions using Java API. This Security Module can be configured on:

• Java Standard Edition (JSE)

• IBM WebSphere

Java Standard Edition (JSE)

To create a Java Security Module instance, you must run the config.sh (Located at OES_CLIENT_HOME/oessm/bin on UNIX) or config.cmd (Located at OES_CLIENT_HOME\oessm\bin on Windows) as follows:

config.sh -smType java -smConfigId mySM_Java_Controlled -pdServer <oes_server_address> -pdPort <oes_server_ssl_port>

In controlled push mode, you will be prompted for the Oracle Entitlements Server Administration Server username, password, and a new key store password for enrollment.

In non-controlled and controlled pull modes, you will be prompted for Oracle Entitlements Server schema username, and Password.

Table 18-7 describes the parameters you specify on the command line.

The Java Security Module Instance is created at OES_CLIENT_HOME/oes_sm_instances/mySM_java. If you use the default values described in Table 18-7.

IBM WebSphere

To configure Java Security Module on IBM WebSphere, complete the following steps:

1. Create a new application server using the IBM WebSphere console and name it OesServer.

2. Start the Oracle Entitlements Server (OesServer) you created for IBM WebSphere.

3. Deploy was-client.war (Located at OES_CLIENT_HOME/oessm/pd) to the Oracle Entitlements Server you created.

4. Open the smconfig.prp file in a text editor and specify the pd client port and the pd app client context. The pd client port number is the SSL port number of the IBM WebSphere application server and pd app client contex is the location where the was-client.jar is deployed. For example:

   oracle.security.jps.pd.was.client.appcontext=pd-client
   oracle.security.jps.pd.clientPort=8002
   

5. Run the config.sh command as follows:

   $OES_CLIENT_HOME/oessm/bin/config.sh -smType was -smConfigId mySM_WAS -pdServer <oes_admin_server> -pdPort <oes_admin_port> -serverNodeName <was_node_name> -serverName <server_name> -serverLocation WAS_HOME
   

   WAS_HOME is the location of the IBM WebSphere Application Server.

   For any distribution mode you choose, you must specify the IBM WebSphere server user name and password, when prompted.

   In controlled push mode, you will be prompted for Oracle Entitlements Server Administration Server user name, Oracle Entitlements Server Administration Server password, and a new key store password for enrollment.

   In non-controlled and controlled-pull modes, you will be prompted for Oracle Entitlements Server schema user name and password.

   Table 18-8 describes the parameters you specify on the command line.

   Table 18-8 IBM WebSphere Security Module Parameter

   Parameter	Distribution Mode	Description
   smType	All	Type of security module instance you want to create. For example, was.
   smConfigId	All	Name of the security module instance. For example, mySM_WAS.
   pdServer	controlled-push	The address of the Oracle Entitlements Server Administration Server.
   pdPort	controlled-push	The SSL port number of the Oracle Entitlements Server Administration Server. For example, 7002.
   serverLocation	All	Location of the IBM WebSphere Server.

   
   

6. Configure SSL for the IBM WebSphere application server as follows:

   1. Import the Oracle WebLogic Server demo trust certificate into IBM WebSphere node default trust keystore and cell default trust keystore by using keytool to export WLS demo trust certificate from WLS demo trust keystore file, or OES trust.jks file into a .der, as shown in the following example:

      keytool -exportcert -keystore $OES_CLIENT_HOME/oessm/enroll/DemoTrust.jks -alias wlscertgencab -file ~/was.der
      

   2. Import the was.der file into WAS node default trust keystore and cell default trust keystore. as follows:

      • You may find the import in IBM WebSphere Administration Server console:

        security->SSL certificate and key management -> Key stores and certificates -> <NodeDefaultTrustStore> <CellDefaultTrustStore> (here you need to choose one name) -> Signer certificates.

      • Click Add.

      • Enter an alias. For example, WLS.

      • Choose the .der file that you exported earlier, and select data type as DER.

   3. Import the issued private key into the IBM WebSphere node default keystore as follows:

      • You may find the import in IBM WebSphere Administration Server console:

        security->SSL certificate and key management -> Key stores and certificates -> NodeDefaultKeyStore -> Personal certificates.

      • Click Import.

      • Select Keystore and enter the path to the keystore file (Located at OES_CLIENT_HOME/oes_sm_instances/mySM_WAS/security/identity.jks)

      • Select JKS as type and enter the password you used to create the keystore file.

      • The certificate alias name is the same name as the hostname.

        Note:

        You must import demo trust certificate into two trust stores for the WAS ND edition. For the private key, you must import one keystore.

   4. Enable Inbound SSL for the server running IBM WebSphere Security Module as follows:

      • In the IBM WebSphere administration console, go to Security >SSL certificate and key management -> Manage endpoint security configurations.

      • Expand inbound tree to get:Inbound->DefaultCell(CellDefaultSSLSettings) -> nodes -> DefaultCellFederatedNode -> servers -> <server name running IBM WebSphere Security Module> and select the server.

      • In the General Properties page, select Override inherited values.

      • From the SSL configuration list, select NodeDefaultSSLSettings.

      • Click Update certificate alias list button and then choose the new imported private key alias in the Certificate alias in key store list.

      • Click Apply.

   5. Enable Out bound SSL for the server running IBM WebSphere Security Module, follows:

      • In the IBM WebSphere administration console, go to Security >SSL certificate and key management -> Manage endpoint security configurations.

      • Expand inbound tree to get:Outbound->DefaultCell(CellDefaultSSLSettings) -> nodes -> DefaultCellFederatedNode -> servers -> <server name running IBM WebSphere Security Module> and select the server.

      • In the General Properties page, select Override inherited values.

      • From the SSL configuration list, select NodeDefaultSSLSettings.

      • Click Update certificate alias list and choose the new imported private key alias in the Certificate alias in key store list.

      • Click Apply.

18.5.3.2 Creating Multi-Protocol Security Module

The Multi-Protocol Security Module is an authorization service (based on service-oriented architecture principles) wrapped around a generic Java Security Module. This section describes how to configure Multi-Protocol Security Module using:

• RMI

• Web Service

RMI

To configure a RMI Security Module Instance, you must run the config.sh (Located at OES_CLIENT_HOME/oessm/bin for UNIX) or config.cmd (Located at OES_CLIENT_HOME\oessm\bin for Windows) as follows:

config.sh -smType rmi -smConfigId mySM_Rmi_Controlled -pdServer <oes_server_address> -pdPort <oes_server_ssl_port> -RMIListeningPort 9405

In controlled push mode, when prompted, specify the Oracle Entitlements Server Administration Server user name, Oracle Entitlements Server Administration Server password, and a new key store password for enrollment.

In non-controlled and controlled-pull distribution modes when prompter specify the Oracle Entitlements Server schema username and password.

Table 18-9 describes the parameters you specify on the command line.

This command also creates client configuration for the RMI Security Module Instance.

Web Service

To create a Webservice Security Module instance, you must run the config.sh (Located at OES_CLIENT_HOME/oessm/bin for UNIX) or config.cmd (Located at OES_CLIENT_HOME\oessm\bin for Windows) as follows:

config.sh -smType ws -smConfigId mySM_Ws_Controlled -pdServer <oes_server_address> -pdPort <oes_server_ssl_port> -WSListeningPort 9410

In controlled push mode, when prompted, specify the Oracle Entitlements Server Administration Server user name, Oracle Entitlements Server Administration Server password, and a new key store password for enrollment.

In non-controlled and controlled-pull distribution modes when prompted, specify the Oracle Entitlements Server schema user name and password.

Table 18-10 describes the parameters you specify on the command line.

This command also creates client configuration for Webservice Security Module Instance.

18.5.3.3 Creating WebLogic Security Module

The WebLogic Security Module is a custom Java Security Module that includes both a Policy Decision Point and a Policy Enforcement Point. It can receive requests directly from the WebLogic Server without the need for explicit authorization API calls. It will only run on the WebLogic Server container.

To configure a WebLogic Server Security Module instance, you must run the config.sh (Located at OES_CLIENT_HOME/oessm/bin on UNIX) or config.cmd (Located at OES_CLIENT_HOME\oessm\bin on Windows) as follows:

config.sh -smType wls -smConfigId mySM_WLS -pdServer <oes server> -pdPort <oes_server_ssl_port>  -serverLocation MW_HOME/wlserver_10.3/

In non-controlled and controlled-pull distribution modes, when prompted, specify the Oracle Entitlements Server schema user name and password.

Table 18-11 described the parameters you specify on the command line.

The Configuration Wizard is displayed. Create a OES Client as described in Section 18.5.4, "Creating the OES Client Domain".

18.5.3.4 Configuring the PDP Proxy Client

Configure a PDP Proxy Client for your web service Security Module or RMI Security Module, as described in Table 18-12:

You must run the config.sh (Located at OES_CLIENT_HOME/oessm/bin on UNIX) or config.cmd (Located at OES_CLIENT_HOME\oessm\bin on Windows) as shown in the following example:

For Java Security Module:

OES_CLIENT_HOME/oessm/bin/config.sh -smType <SM_TYPE> -smConfigId <SM_NAME>

The SM_TYPE can be java, wls, or was. and for SM_NAME enter an appropriate name.